ClawHub
Back to skill

Security audit

Crypto Kline BTC加密货币K线数据-Binance

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Binance market-data collector, with some implementation and proxy-trust caveats but no evidence of hidden control, credential theft, destructive behavior, or agent hijacking.

Install only if you are comfortable with a Chinese-language Binance data collector that makes public Binance API requests and writes local SQLite databases. Prefer running it with a trusted or no proxy, and avoid passing untrusted symbol, interval, or database-path values through automation.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/crypto-kline.py:28
Finding

Unvalidated User Input Interpolated into SQLite Statements

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/binance-kline.js:25
Finding

Node.js Proxy Mode Removes End-to-End TLS Protection

Content
View full analysis
{ let data = ''; res.on('data', chunk => data += chunk); res.on('end', () => { try { const klines = JSON.parse(data); resolve(klines); } catch (e) { reject(e); } }); }); ``` Proxy selection is externally controlled: ```javascript const proxy = args[3] || process.env.HTTPS_PROXY || process.env.http_proxy; ``` ### Technical Analysis Without a proxy, the script uses Node.js `https` and establishes TLS directly with `api.binance.com`. When a proxy is configured, however, it switches unconditionally to the plaintext `http` client and submits the full Binance HTTPS URL as the request path. This is not an HTTPS `CONNECT` tunnel. There is no TLS session between the script and Binance, and the script does not authenticate Binance's certificate in proxy mode. The proxy terminates or independently performs the upstream request and can inspect, replace, truncate, or fabricate the response returned to the script. The implementation also chooses the `http` module even if the supplied proxy URL uses the `https:` scheme. Thus, proxy scheme handling is inconsistent and may cause insecure transport or connection failures. The response handler does not verify the HTTP status code, content type, or expected Binance response schema. Any JSON value is resolved as a successful result and subsequently treated as candlestick data. ### Attack Path 1. A user supplie ...[truncated 1536 chars]
Remediation
View remediation
= 300) { reject(new Error(`Unexpected HTTP status: ${res.statusCode}`)); return; } ``` 6. Validate that the response is an array of candlestick arrays with the expected number and types of fields before displaying or processing it. 7. Set response-size limits to prevent an untrusted proxy from exhausting memory through an excessively large response. 8. Document that the configured proxy is part of the trust boundary. Avoid hardcoded or organization-specific proxy defaults, and prefer an opt-in proxy configuration. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The file presents all user-facing instructions and descriptions exclusively in Chinese, which can amount to forcing a specific language without offering the user a choice. The policy for this audit flags language or locale constraints when they are not optional or explicitly justified.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

数据库表结构

sql
CREATE TABLE {symbol}_{interval}_kline (
    id INTEGER PRIMARY KEY AUTOINCREMENT,
    timestamp INTEGER,
    open_time TEXT,

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/binance-kline.js (reported line 19)May include surrounding context.

js
function fetchKlines(symbol, interval, limit = 100, proxy = null) {
  return new Promise((resolve, reject) => {
    const url = `https://api.binance.com/api/v3/klines?symbol=${symbol}&interval=${interval}&limit=${limit}`;
    
    const options = {
      timeout: 30000

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/crypto-kline.py (reported line 53)May include surrounding context.

python
function fetchKlines(symbol, interval, limit = 100, proxy = null) {
  return new Promise((resolve, reject) => {
    const url = `https://api.binance.com/api/v3/klines?symbol=${symbol}&interval=${interval}&limit=${limit}`;
    
    const options = {
      timeout: 30000

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The file-level description is entirely in Chinese, and all user-facing CLI messages and help text in the script are also Chinese, which imposes a locale/language choice on users without opt-in. The policy explicitly calls out forced language or locale as a natural-language violation when no choice is offered.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file’s descriptive comments and runtime usage/help text are entirely in Chinese, and the script does not offer any locale or language selection. This is a natural-language policy concern when a skill imposes a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.